NX_SERVER_SELINUX(8)

💖 NAME 💖

Okay bestie, welcome to the nx_server_selinux(8) page — the nx_server SELinux Policy documentation. This is all about nx_server_r, the nx_server user role, and the Security Enhanced Linux Policy behind it. 👑

---

✨ DESCRIPTION ✨

SELinux supports Roles Based Access Control, aka RBAC. Some Linux roles are login roles, and some roles need to be transitioned into. Lowkey important distinction, fr fr.

Quick note: the examples in this man page use the staff_u SELinux user. 🫶

Non login roles are usually used for administrative tasks — think tasks that require root privileges. Roles control which types a user can run processes with, and roles often have default types assigned to them.

The default type for the nx_server_r role is nx_server_t.

The newrole program is there to transition directly into this role:

newrole -r nx_server_r -t nx_server_t

sudo is the preferred method to transition from one role to another. You set up sudo to transition to nx_server_r by adding a similar line to the /etc/sudoers file:

USERNAME ALL=(ALL) ROLE=nx_server_r TYPE=nx_server_t COMMAND

sudo will run COMMAND as staff_u:nx_server_r:nx_server_t:LEVEL.

When you're using a non login role, you need to set up SELinux so that your SELinux user can reach the nx_server_r role.

Run this to see all of the assigned SELinux roles:

semanage user -l

You need to add nx_server_r to the staff_u user. You could set up the staff_u user to be able to use the nx_server_r role with a command like this:

$ semanage user -m -R 'staff_r system_r nx_server_r' staff_u

---

🎀 BOOLEANS 🎀

SELinux policy is customizable based on least access required. The nx_server policy is extremely flexible and has several booleans that let you manipulate the policy and run nx_server with the tightest access possible. Obsessed with a tight permissions vibe. 💅

If you want to dontaudit all daemons scheduling requests (setsched, sys_nice), you must turn on the daemons_dontaudit_scheduling boolean. Enabled by default.

setsebool -P daemons_dontaudit_scheduling 1

If you want to allow all domains to execute in fips_mode, you must turn on the fips_mode boolean. Enabled by default.

setsebool -P fips_mode 1

---

🗂 MANAGED FILES 🗂

The SELinux process type nx_server_t can manage files labeled with the following file types. The paths listed are the default paths for these file types. Note: the process’s UID still needs to have DAC permissions.

cluster_conf_t

/etc/cluster(/.*)?

cluster_var_lib_t

/var/lib/pcsd(/.*)?
/var/lib/cluster(/.*)?
/var/lib/openais(/.*)?
/var/lib/pengine(/.*)?
/var/lib/corosync(/.*)?
/usr/lib/heartbeat(/.*)?
/var/lib/heartbeat(/.*)?
/var/lib/pacemaker(/.*)?

cluster_var_run_t

/run/crm(/.*)?
/run/cman_.*
/run/rsctmp(/.*)?
/run/aisexec.*
/run/heartbeat(/.*)?
/run/pcsd-ruby.socket
/run/corosync-qnetd(/.*)?
/run/corosync-qdevice(/.*)?
/run/pcsd.socket
/run/corosync.pid
/run/cpglockd.pid
/run/rgmanager.pid
/run/cluster/rgmanager.sk

nx_server_home_ssh_t

/opt/NX/home/nx/.ssh(/.*)?
/usr/NX/home/nx/.ssh(/.*)?
/var/lib/nxserver/home/.ssh(/.*)?

nx_server_tmp_t

No default paths listed under it here.

nx_server_var_lib_t

/opt/NX/home(/.*)?
/usr/NX/home(/.*)?
/var/lib/nxserver(/.*)?

nx_server_var_run_t

/opt/NX/var(/.*)?

root_t

/sysroot/.aleph-version.json
/sysroot/ostree/deploy/.*-atomic/deploy(/.*)?
/
/initrd
/var/lib/ntp

ssh_home_t

/var/lib/[^/]+/.ssh(/.*)?
/root/.ssh(/.*)?
/var/lib/one/.ssh(/.*)?
/srv/gitolite/.ssh(/.*)?
/srv/gitolite3/.ssh(/.*)?
/var/lib/pgsql/.ssh(/.*)?
/var/lib/openshift/[^/]+/.ssh(/.*)?
/var/lib/amanda/.ssh(/.*)?
/var/lib/stickshift/[^/]+/.ssh(/.*)?
/var/lib/nocpulse/.ssh(/.*)?
/var/lib/openshift/gear/[^/]+/.ssh(/.*)?
/root/.shosts
/home/[^/]+/.ssh(/.*)?
/home/[^/]+/.ansible/cp/.*
/home/[^/]+/.shosts

---

💅 COMMANDS 💅

• semanage fcontext can also be used to manipulate default file context mappings.
• semanage permissive can also be used to manipulate whether or not a process type is permissive.
• semanage module can also be used to enable/disable/install/remove policy modules.
• semanage boolean can also be used to manipulate the booleans
• system-config-selinux is a GUI tool available to customize SELinux policy settings.

---

🫶 AUTHOR 🫶

This manual page was auto-generated using sepolicy manpage .

---

🌈 SEE ALSO 🌈

selinux(8), nx_server(8), semanage(8), restorecon(8), chcon(1), sepolicy(8), setsebool(8), nx_server_ssh_selinux(8), nx_server_ssh_selinux(8)

---

Cute footer sign-off, bestie: this page is from nx_server, credits mgrepl@redhat.com, and it’s the nx_server_selinux(8) page — no separate date shown on that footer line. 💖✨